Arcjet AI security models: A family of custom-trained security models for coding agents
Arcjet, which calls itself an AI agent runtime security platform, has launched custom-trained models that detect prompt injection, where untrusted input overrides a developer's instructions. The first, Arcjet Himalia 1, is live for every SDK call that uses prompt injection detection. It is built on Qwen3-0.6B, a 0.6-billion-parameter open-weight model under the Apache 2.0 license, with its text-generation output replaced by a two-way classifier that labels input as benign or injection.
Two specialist models follow. Arcjet Thebe 1 is for coding agents and aims to separate routine development commands from malicious instructions hidden in tool outputs, web pages and repositories. Arcjet Carme 1 is for autonomous security agents, which read vulnerability reports and malicious code that generic filters may flag, and it looks for instructions meant to leak secrets or add malicious dependencies. Both are in early access.
Arcjet reports F1 scores of 0.964 and 0.971 for Himalia 1 on two public prompt injection datasets. Its announcement, carried by PR Newswire, says the models were fine-tuned on manually reviewed public datasets and proprietary data, and that they are also tested against encoded attacks such as base64 and reversed text. Computer Weekly ran a byline piece from Arcjet on the same launch.
Why it matters
For teams shipping AI features, input screening is becoming a per-agent decision rather than one filter for everything. Arcjet's own examples show the same query can be an attack against a chatbot and a routine request for a coding agent, so vendors will need to measure false positives against their own workflows. Arcjet says compact classifiers can flag malicious instructions in milliseconds, which matters when a check runs on every request and before an agent executes a command.
For investors, the claim is that security belongs inside the application and agent loop, where identity, session and tool context are visible, rather than only at a network gateway. Arcjet says its detection runs in code and covers activity that never passes through a central gateway. Building on an open-weight base lowers the cost of entering this category, so any durable advantage would depend on proprietary training data, evaluation quality and distribution through SDKs and agent integrations.
Key points
- 1Arcjet Himalia 1 is live for every SDK call that uses prompt injection detection.
- 2The general model replaces a previous setup that relied on two open-source classifiers.
- 3The base model is Qwen3-0.6B, a 0.6-billion-parameter open-weight model under Apache 2.0.
- 4Arcjet reports F1 scores of 0.964 and 0.971 on two public prompt injection datasets.
- 5
